Threat Hunter Investigator

Zachary Piper Solutions; United States; Remote; USD 140,000 - 190,000; Full time

Benefits offered by this job

Medical, dental, vision

401(k)

PTO & sick leave

Fully remote work

Job summary

Piper Companies is seeking a senior Threat Hunting Investigator for a fully remote role operating on EST business hours. The candidate will lead insider threat investigations, develop sophisticated Splunk detections, and implement RBA/UEBA workflows across a global technology environment.

Ideal candidates will have 8+ years in threat investigations, hands-on Splunk Enterprise Security expertise, and a proven ability to translate intelligence into production-ready detections and security

Qualifications

• 8+ years of experience in digital threat investigations, insider threat analysis, and forensic investigations.
• Advanced hands-on experience with Splunk Enterprise Security, including authoring complex SPL queries.
• Strong experience developing and managing RBA and UEBA programs.
• Proven ability to translate threat intelligence and MITRE ATT&CK techniques into production-ready detections and security workflows.

Responsibilities

• Conduct proactive threat hunting and investigations focused on insider threats, suspicious user activity, and protection of critical intellectual property.
• Develop, test, deploy, and tune advanced Splunk detection content using SPL, correlation searches, risk rules, and notable events.
• Configure and optimize RBA and UEBA workflows to identify high-risk behaviors and improve threat detection capabilities.
• Produce clear investigative reports, technical documentation, and actionable recommendations for security stakeholders.

Skills

Insider threat investigations

SPLUNK detection engineering

SPL queries

Risk-Based Alerting (RBA)

UEBA

MITRE ATT&CK mapping

Digital threat investigations

Forensic investigations

Tools

Splunk Enterprise Security

Job description

Piper Companies is seeking a Threat Hunting Investigator for a leading technology organization. The Threat Hunting Investigator is a Remote position operating on EST business hours. An ideal candidate for the Threat Hunting Investigator is a senior cybersecurity professional with deep experience in insider threat investigations, advanced Splunk detection engineering, and hands-on expertise developing SPL queries, Risk-Based Alerting (RBA), and User and Entity Behavior Analytics (UEBA) solutions.

Responsibilities of the Threat Hunting Investigator:

• Conduct proactive threat hunting and investigations focused on insider threats, suspicious user activity, and protection of critical intellectual property.
• Develop, test, deploy, and tune advanced Splunk detection content using SPL, correlation searches, risk rules, and notable events.
• Configure and optimize RBA and UEBA workflows to identify high-risk behaviors and improve threat detection capabilities.
• Produce clear investigative reports, technical documentation, and actionable recommendations for security stakeholders.

Qualifications of the Threat Hunting Investigator:

• 8+ years of experience conducting digital threat investigations, insider threat analysis, and forensic investigations.
• Advanced hands-on experience with Splunk Enterprise Security, including authoring complex SPL queries from scratch.
• Strong experience developing and managing Risk-Based Alerting (RBA) and User and Entity Behavior Analytics (UEBA) programs.
• Proven ability to translate threat intelligence and MITRE ATT&CK techniques into production-ready detections and security workflows.

Compensation for the Threat Hunting Investigator includes:

• Comprehensive benefits package including medical, dental, vision, 401(k), sick leave as required by law, and PTO.
• Fully remote work environment with EST business hours.
• Opportunity to support enterprise-level insider threat investigations within a globally recognized technology environment.

This job opens for applications on 10/16/2026. Applications for this job will be accepted for at least 30 days from the posting date.

#LI-MM9

#LI-REMOTE